Re: Using mysql_real_escape_string without connecting to mysql
| From: | Dotan Cohen | Date: | Wed, 23 Jan 2008 21:52:24 +0000 |
| Subject: | Re: Using mysql_real_escape_string without connecting to mysql | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-267947@lists.php.net to get a copy of this message | ||
On 23/01/2008, Chris <dmagick@gmail.com> wrote:
> > I'm not accepting "--" at all until someone can show me a real world
> > case where one would use it, without the intention of SQL injection.
> > How can it be escaped, anyway?
>
> Depends on your app.
>
> -- is an accepted things in emails as a marker for signatures.
You win that one.
> Also in mysql_query ; is automatically handled, you can't send multiple
> queries to mysql_query and have them execute.
>
> mysql_query() sends an unique query (multiple queries are not supported)
Very nice to know this. Thanks.
Dotan Cohen
http://what-is-what.com
http://gibberish.co.il
א-ב-ג-ד-ה-ו-ז-ח-ט-י-ך-כ-ל-ם-מ-ן-נ-ס-ע-ף-פ-ץ-צ-ק-ר-ש-ת
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?